Privacy Policy

Effective date: 19 July 2026

Keystone Labs (“Keystone Labs”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, hold, use, disclose, and protect personal information when you:

  • visit or use https://keystonelabs.co.nz/;
  • create an account;
  • place an order;
  • contact us;
  • submit a product review, comment, or other content;
  • subscribe to marketing communications;
  • interact with us through email, telephone, social media, advertising, or another channel; or
  • otherwise purchase or enquire about our products and services.

This policy is intended to comply with the Privacy Act 2020 and the applicable Information Privacy Principles.

1. Who we are

Keystone Labs operates the website: keystonelabs.co.nz

For privacy enquiries, requests, complaints, access requests, correction requests, or deletion requests, please contact us through:

https://keystonelabs.co.nz/contact-us

Please clearly state that your enquiry relates to privacy and provide enough information for us to identify you and understand your request.

2. What is personal information?

Personal information is information about an identifiable individual.

It may include information that identifies you directly, such as your name and email address, as well as information that may identify you when combined with other information, such as an IP address, order history, device information, or customer account activity.

This policy generally does not apply to information about companies or other organisations unless the information also identifies an individual, such as a sole trader, employee, contact person, director, or account holder.

3. Personal information we collect

Depending on how you interact with us, we may collect the following information.

3.1 Identity and contact information

This may include:

  • your name;
  • company or organisation name;
  • billing address;
  • delivery address;
  • email address;
  • telephone number;
  • account username;
  • customer or account number; and
  • the names and contact details of authorised contacts.

3.2 Order and transaction information

When you place or attempt to place an order, we may collect:

  • the products you purchase or place in your cart;
  • order quantities;
  • order values;
  • discount or promotional information;
  • billing and shipping details;
  • delivery instructions;
  • payment method;
  • payment status;
  • transaction references;
  • refund, return, warranty, or credit information;
  • correspondence relating to your order; and
  • your order history.

We may retain records of completed, cancelled, failed, refunded, or abandoned transactions where reasonably necessary for customer service, security, fraud prevention, accounting, system administration, or legal compliance.

3.3 Payment information

Payments may be processed by third-party payment service providers.

Depending on the payment method, the payment provider may collect card details, bank information, account information, authentication information, or other payment-related information directly from you.

Keystone Labs does not ordinarily receive or store your complete payment card number or card security code. We may receive limited payment information, such as:

  • the payment method used;
  • the card brand;
  • the last few digits of a card;
  • transaction identifiers;
  • payment status;
  • fraud or risk indicators; and
  • refund information.

The payment provider’s handling of your information is also governed by its own privacy policy and terms.

3.4 Account information

If you create an account, we may store:

  • your account details;
  • your password in encrypted or hashed form;
  • saved billing and delivery addresses;
  • order history;
  • communication preferences;
  • saved carts or wish lists, where available;
  • account login and security records; and
  • other information associated with your account.

You are responsible for keeping your login details confidential and notifying us if you suspect unauthorised access to your account.

3.5 Enquiries and communications

When you contact us, we may collect:

  • the information you enter into a contact form;
  • emails and attachments you send us;
  • telephone call details or notes;
  • chat or messaging history;
  • product questions;
  • quotation requests;
  • support requests;
  • warranty or return information;
  • feedback and complaints; and
  • any other information you choose to provide.

We may associate these communications with your customer account or order history where this helps us respond to you or maintain accurate business records.

3.6 Comments, reviews, and user-submitted content

If you submit a product review, website comment, question, photograph, or other content, we may collect and store:

  • the content you submit;
  • your name or chosen display name;
  • your email address;
  • your IP address;
  • browser and device information;
  • the date and time of submission; and
  • information used for spam, fraud, or abuse detection.

Approved comments or reviews may be displayed publicly alongside your name or chosen display name.

We will not normally publish your email address or IP address. However, anything you include within the public text of your review or comment may become publicly visible.

Comments, reviews, and related metadata may be retained indefinitely unless removed by us or following an appropriate request. We may retain limited records after removing public content where reasonably necessary for moderation, security, dispute resolution, or legal compliance.

3.7 Website and technical information

When you visit our website, our systems and service providers may automatically collect information such as:

  • your IP address;
  • browser type and version;
  • device type;
  • operating system;
  • screen size;
  • language and time-zone settings;
  • referring website;
  • pages viewed;
  • links clicked;
  • products viewed;
  • searches performed;
  • cart activity;
  • checkout activity;
  • session identifiers;
  • approximate location derived from your IP address;
  • login attempts;
  • error logs; and
  • the date, time, and duration of your visit.

This information may be recorded in website logs, security systems, analytics services, ecommerce systems, and cookies.

3.8 Marketing and preference information

We may collect:

  • whether you have subscribed to marketing communications;
  • the date, time, source, and method of your subscription;
  • your communication preferences;
  • whether emails were delivered, opened, or clicked;
  • whether you have unsubscribed;
  • products or categories in which you appear interested; and
  • advertising interaction information.

3.9 Fraud-prevention and security information

We may collect or generate information used to identify suspicious, fraudulent, abusive, or unauthorised activity, including:

  • IP addresses;
  • attempted transactions;
  • order patterns;
  • device or browser indicators;
  • failed login attempts;
  • payment-risk results;
  • suspected misuse of discount codes;
  • spam indicators; and
  • records of security incidents.

3.10 Information relating to returns, warranties, and product support

Where you make a return, warranty claim, or technical support request, we may collect:

  • proof of purchase;
  • product serial numbers;
  • photographs or videos;
  • fault descriptions;
  • testing or inspection results;
  • correspondence;
  • return delivery details;
  • refund or replacement information; and
  • information reasonably required to assess the claim.

Please avoid including unrelated personal, confidential, or sensitive information in photographs, recordings, devices, or files sent to us.

4. How we collect personal information

We generally collect personal information directly from you when you:

  • browse our website;
  • create or update an account;
  • place an order;
  • make a payment;
  • contact us;
  • submit a review or comment;
  • request a quote;
  • enter a promotion;
  • subscribe to marketing;
  • submit a return or warranty request; or
  • otherwise communicate or transact with us.

We may also collect information automatically through cookies, server logs, analytics systems, fraud-prevention systems, ecommerce software, and similar technologies.

5. Information collected from other sources

In some circumstances, we may receive personal information from another person or organisation rather than directly from you.

These sources may include:

  • a company, employer, employee, or colleague placing an order on your behalf;
  • a person purchasing and sending a product to you;
  • payment processors and financial institutions;
  • freight companies and delivery providers;
  • ecommerce and website service providers;
  • fraud-prevention, identity-verification, or security providers;
  • advertising and analytics providers;
  • publicly available business directories;
  • social media platforms;
  • suppliers, repair agents, or warranty providers;
  • debt collection, legal, or professional advisers; and
  • government or regulatory agencies where permitted by law.

Where required by the Privacy Act, we will take reasonable steps to notify you when we collect personal information about you from another source. Notice may not be required where an exception applies, including where you have already been made aware of the collection, notification would be impracticable, the information is publicly available, or notification would prejudice a lawful purpose.

6. Why we collect and use personal information

We may collect and use personal information to:

  • provide and operate our website;
  • create and administer customer accounts;
  • receive, process, fulfil, and deliver orders;
  • process payments, refunds, and credits;
  • communicate about orders, deliveries, returns, recalls, or warranties;
  • provide quotations, support, and customer service;
  • respond to enquiries, requests, and complaints;
  • confirm your identity or authority to act for an account;
  • maintain transaction, accounting, tax, and business records;
  • manage stock, purchasing, delivery, and customer relationships;
  • publish and moderate reviews, comments, and questions;
  • detect and prevent spam, fraud, cyberattacks, and misuse;
  • secure, troubleshoot, test, maintain, and improve our website;
  • understand website usage and customer preferences;
  • improve our products, services, range, pricing, and website experience;
  • measure the effectiveness of advertising and promotions;
  • send service-related and transactional communications;
  • send marketing communications where permitted;
  • enforce our terms, policies, and legal rights;
  • resolve disputes and defend legal claims;
  • comply with laws, court orders, and regulatory requirements; and
  • carry out another purpose authorised by you or permitted by law.

We will not ordinarily use personal information for a purpose unrelated to the purpose for which it was collected unless you authorise the use or the use is otherwise permitted by law.

7. Information you must provide

You may choose not to provide personal information. However, some information is required for us to provide particular products or services.

For example, we generally need your name, contact details, billing details, delivery details, and payment information to process and deliver an order.

If you do not provide required information, we may be unable to:

  • complete your order;
  • deliver products;
  • establish or maintain an account;
  • process a refund;
  • assess a warranty claim;
  • respond fully to an enquiry; or
  • provide another requested service.

Where a field is optional, you may generally leave it blank.

8. Cookies and similar technologies

Our website may use cookies, pixels, local storage, session storage, tags, scripts, and similar technologies.

A cookie is a small data file placed on your browser or device.

8.1 Essential cookies

Essential cookies may be used to:

  • maintain website sessions;
  • remember cart contents;
  • operate checkout functions;
  • authenticate logged-in users;
  • remember cookie preferences;
  • prevent fraud;
  • provide security; and
  • maintain website functionality.

Disabling essential cookies may prevent parts of the website from operating correctly.

8.2 Preference cookies

Preference cookies may remember:

  • language or regional preferences;
  • account or display settings;
  • recently viewed products; and
  • other choices you have made.

8.3 Analytics cookies

Analytics technologies may help us understand:

  • how visitors find our website;
  • which pages and products are viewed;
  • how visitors navigate the website;
  • whether technical errors occur; and
  • how the website can be improved.

Analytics data may be aggregated or pseudonymised, but some analytics providers may receive identifiers, IP addresses, device information, and usage information.

8.4 Advertising cookies

Where used, advertising technologies may:

  • measure advertising performance;
  • limit repeated advertising;
  • create audiences;
  • attribute website visits or purchases to advertising;
  • display advertising based on previous interactions; and
  • help us understand the effectiveness of campaigns.

These technologies may be provided by third parties and may allow those parties to recognise your browser or device across different websites or services.

8.5 Managing cookies

You can control cookies through your browser settings and, where available, our website’s cookie controls.

You may be able to:

  • block cookies;
  • delete existing cookies;
  • restrict third-party cookies;
  • receive a warning before cookies are stored; or
  • use private browsing or tracking-protection settings.

Blocking cookies may affect website functionality, including account login, cart, and checkout functions.

9. Embedded content and third-party services

Pages on our website may include embedded or linked content, such as:

  • videos;
  • maps;
  • social media content;
  • payment tools;
  • product feeds;
  • reviews;
  • fonts;
  • chat services;
  • analytics; or
  • other third-party features.

When you interact with embedded content, the third-party provider may collect information as though you had visited its website directly. This may include your IP address, device information, cookies, account activity, and interaction data.

Third-party websites and services are governed by their own privacy policies. Keystone Labs is not responsible for the privacy practices of third parties that operate independently from us.

10. Who we may disclose personal information to

We may disclose personal information where reasonably necessary to:

  • website hosting and infrastructure providers;
  • ecommerce platform providers;
  • payment processors and financial institutions;
  • freight, courier, postal, and logistics providers;
  • email, messaging, and customer-service providers;
  • accounting, inventory, business-management, or CRM providers;
  • cloud storage and data-processing providers;
  • analytics and advertising providers;
  • cybersecurity, fraud-prevention, and spam-filtering providers;
  • suppliers, distributors, manufacturers, service agents, and repair agents;
  • warranty providers;
  • professional advisers, including accountants, lawyers, insurers, and auditors;
  • debt collection or credit-management providers;
  • government agencies, regulators, Police, courts, and law-enforcement bodies where required or permitted by law;
  • a purchaser, investor, adviser, or successor in connection with a proposed or completed sale, merger, restructuring, financing, or transfer of our business or assets; and
  • any other person you authorise us to disclose information to.

We aim to disclose only the information reasonably necessary for the relevant purpose.

We do not sell your personal information as a standalone commercial product.

11. Couriers and delivery providers

To deliver your order, we may provide a courier, freight provider, supplier, or fulfilment provider with information such as:

  • your name;
  • delivery address;
  • telephone number;
  • email address;
  • delivery instructions;
  • order or consignment reference;
  • product quantity, weight, or dimensions; and
  • information required for customs or cross-border delivery.

Delivery providers may use this information to deliver your order, send tracking notifications, manage delivery issues, meet legal requirements, and maintain delivery records.

12. Overseas storage and disclosure

Some of our service providers, technology providers, payment providers, manufacturers, suppliers, or other recipients may be located outside New Zealand or may store information using overseas infrastructure.

This means your information may be processed or stored in countries whose privacy laws differ from New Zealand law.

Before disclosing personal information outside New Zealand, we will take reasonable steps required by the Privacy Act. Depending on the circumstances, this may include:

  • confirming that the overseas recipient is subject to the Privacy Act;
  • confirming that the recipient is subject to privacy safeguards comparable to those in New Zealand;
  • entering into contractual privacy protections;
  • using a provider operating under an approved binding scheme; or
  • obtaining your informed authorisation where appropriate.

Information processed by an overseas provider on our behalf may, depending on the arrangement, be treated as information held by us rather than a disclosure to that provider.

13. Marketing communications

We may send you marketing communications where:

  • you have consented;
  • consent can reasonably be inferred from an existing business relationship; or
  • the communication is otherwise permitted by law.

Marketing communications may include:

  • product announcements;
  • special offers;
  • promotions;
  • educational content;
  • back-in-stock notifications;
  • newsletters; and
  • information we believe may be relevant to you.

Commercial electronic messages will identify the sender and provide a functional method of unsubscribing where required.

You can unsubscribe by:

Unsubscribing from marketing will not prevent us from sending necessary transactional or service communications, such as order confirmations, invoices, delivery updates, warranty communications, security notices, or product recalls.

We may retain limited suppression information after you unsubscribe so that we can honour your request and avoid adding you back to a marketing list unintentionally.

14. Security

We take reasonable safeguards to protect personal information against:

  • loss;
  • misuse;
  • unauthorised access;
  • unauthorised disclosure;
  • alteration;
  • destruction; and
  • other inappropriate use.

Safeguards may include:

  • encrypted website connections;
  • password controls;
  • access restrictions;
  • software updates;
  • backups;
  • malware and spam protection;
  • security monitoring;
  • payment-provider security controls;
  • staff or contractor confidentiality obligations; and
  • limiting access to people who need the information for their work.

No method of online transmission or electronic storage is completely secure. Although we take reasonable precautions, we cannot guarantee that unauthorised access, cyberattacks, technical failures, or other incidents will never occur.

You should use a unique, strong password for your account and avoid sharing it with other people.

15. Privacy breaches

A privacy breach may include the accidental or unauthorised access, disclosure, alteration, loss, destruction, or unavailability of personal information.

If we become aware of a privacy breach, we will assess it and take reasonable steps to:

  • contain the incident;
  • investigate what occurred;
  • reduce potential harm;
  • restore the security of affected systems;
  • prevent recurrence; and
  • meet any notification obligations.

Where a breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as reasonably practicable, unless an applicable legal exception allows notification to be delayed or withheld.

16. How long we retain personal information

We retain personal information only for as long as it is reasonably required for the purposes for which it was collected or as required or permitted by law.

Retention periods may vary depending on the type of information and the reason it is held.

16.1 Order and accounting records

Order, invoice, payment, refund, and accounting records may generally be retained for at least the period required by New Zealand tax, accounting, company, and commercial laws.

Some records may be retained longer where necessary for:

  • warranties;
  • product recalls;
  • legal claims;
  • dispute resolution;
  • fraud prevention;
  • enforcement of agreements;
  • audit requirements; or
  • another lawful business purpose.

16.2 Customer accounts

Account information may be retained while the account remains active and for a reasonable period afterwards.

Closing or deleting an account does not necessarily require us to delete transaction records or other information that we are legally required or reasonably entitled to retain.

16.3 Contact forms and correspondence

Enquiries and correspondence may be retained for as long as reasonably necessary to respond, maintain customer-service records, manage disputes, or meet legal and operational requirements.

16.4 Comments and reviews

Comments, reviews, and associated metadata may be retained indefinitely to preserve the context and integrity of website discussions, unless removal is appropriate.

16.5 Security and technical logs

Website, access, and security logs may be retained for a period reasonably required for security monitoring, diagnostics, fraud prevention, investigation, backup management, and system administration.

16.6 Marketing records

Marketing subscription and engagement information may be retained while you remain subscribed.

Unsubscribe and suppression records may be retained for as long as necessary to ensure that your opt-out preference continues to be respected.

16.7 Backups

Deleted information may remain in secure system backups for a limited period until those backups are overwritten or deleted in the ordinary course of business.

Backup information is not ordinarily accessed unless needed for disaster recovery, security, or legal purposes.

17. Accessing your personal information

You have the right to ask whether we hold personal information about you and to request access to that information, subject to the Privacy Act.

You can submit an access request through:

https://keystonelabs.co.nz/contact-us

Please include:

  • your full name;
  • your email address;
  • relevant order or account details;
  • a description of the information requested; and
  • any information reasonably needed to verify your identity.

We may ask you to provide proof of identity before releasing personal information.

We will respond as soon as reasonably practicable and within the timeframe required by the Privacy Act. In some circumstances, the Act permits us to extend the response period or withhold some information. If this applies, we will explain the position where required.

18. Correcting your personal information

You may ask us to correct personal information that you believe is inaccurate, incomplete, or misleading.

Correction requests can be submitted through:

https://keystonelabs.co.nz/contact-us

Where appropriate, you may also be able to update certain information through your online account.

If we do not make a requested correction, you may ask us to attach a statement of correction to the information, as provided for under the Privacy Act.

19. Deletion and account-closure requests

You may request deletion of personal information or closure of your customer account through:

https://keystonelabs.co.nz/contact-us

Please state that you are making a personal-information deletion request and provide sufficient information for us to identify you and locate the relevant records.

A deletion request does not create an absolute right to have every record erased.

We may need or be entitled to retain some information where it is reasonably necessary to:

  • comply with tax, accounting, consumer, company, or other legal obligations;
  • maintain records of completed transactions;
  • administer warranties, product recalls, returns, or refunds;
  • establish, exercise, or defend legal claims;
  • investigate fraud, misuse, security incidents, or unlawful conduct;
  • maintain unsubscribe or suppression records;
  • protect the rights or safety of Keystone Labs, our customers, or other people;
  • maintain the integrity of business, audit, or security records; or
  • carry out another purpose permitted by the Privacy Act.

Where complete deletion is not appropriate, we may instead:

  • delete information that is no longer required;
  • anonymise information;
  • restrict how information is used;
  • remove information from public display; or
  • retain only the minimum information reasonably required.

We may request proof of identity before completing a deletion or account-closure request.

20. Requests made on behalf of another person

You may make a privacy request on behalf of another person only where you have appropriate authority.

We may ask for:

  • written authorisation;
  • evidence of guardianship or legal authority;
  • proof of identity for both parties; or
  • other information reasonably required to confirm that authority.

We will not provide another person’s information merely because the requester is a family member, colleague, employer, or account contact.

21. Accuracy of information

We take reasonable steps to ensure that personal information is accurate, complete, relevant, and up to date before using or disclosing it.

You can help by:

  • providing accurate information;
  • keeping your account details current;
  • checking delivery and billing information before submitting an order; and
  • notifying us when your information changes.

We are not responsible for delays, failed deliveries, or other issues caused by inaccurate information supplied to us, although we will take reasonable steps to help correct the issue.

22. Children’s privacy

Our website and products are not specifically directed at young children.

Where a person under 18 uses our website or places an order, we may take additional steps where reasonably necessary to confirm that the transaction is appropriate or authorised.

Parents and guardians who believe a child has provided us with personal information inappropriately may contact us through:

https://keystonelabs.co.nz/contact-us

23. Automated processing and fraud screening

Our website, payment providers, and security providers may use automated tools to assess transactions, detect spam, identify fraud, protect accounts, or prevent misuse.

These systems may consider information such as:

  • transaction amount;
  • delivery and billing information;
  • IP address;
  • device information;
  • account history;
  • payment results;
  • order patterns; and
  • other risk indicators.

An order may be delayed, reviewed, declined, or cancelled where it appears suspicious, unlawful, unauthorised, or inconsistent with our terms.

You may contact us if you believe an automated or security-related decision has been made incorrectly.

24. Links to other websites

Our website may contain links to third-party websites.

We do not control and are not responsible for the privacy, security, content, or practices of those websites.

You should review the privacy policy of any third-party website before providing it with personal information.

25. Business transfers

If Keystone Labs or its assets are sold, merged, reorganised, financed, or transferred, personal information may be disclosed to advisers, potential purchasers, investors, financiers, or the new owner.

Any recipient will be required to handle personal information in accordance with applicable privacy law and any binding confidentiality obligations.

26. Legal disclosure

We may disclose personal information where we reasonably believe disclosure is necessary or permitted to:

  • comply with a law, warrant, court order, or regulatory requirement;
  • respond to a lawful request from Police or another government agency;
  • prevent or investigate fraud, cybercrime, or unlawful activity;
  • protect the safety of an individual;
  • enforce our terms or legal rights; or
  • establish, exercise, or defend a legal claim.

We will assess requests for information and disclose only what we reasonably consider necessary or legally required.

27. Privacy complaints

If you believe we have mishandled your personal information, please contact us first so that we have an opportunity to investigate and resolve your concern.

Privacy complaints can be submitted through:

https://keystonelabs.co.nz/contact-us

Please provide:

  • your name and contact details;
  • a description of the issue;
  • relevant dates, orders, or communications;
  • the outcome you are seeking; and
  • any supporting information.

We will acknowledge and investigate privacy complaints within a reasonable time.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner of New Zealand.

28. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • changes to our website or business;
  • changes to the services we use;
  • changes to our data-handling practices;
  • new legal or regulatory requirements; or
  • security and operational improvements.

The current version will be published on our website with an updated effective date.

Where a change is significant, we may provide additional notice through the website, email, or another appropriate channel.

Your continued use of the website after an updated policy is published does not remove any rights you have under the Privacy Act.

29. Contacting us

For privacy enquiries, access requests, correction requests, deletion requests, account-closure requests, or complaints, please contact Keystone Labs through:

https://keystonelabs.co.nz/contact-us

Please mark your request as “Privacy Request” and provide enough information for us to verify your identity and respond appropriately.